Microsoft Office applications don't open when Fasoo is present along with Trellix ENS

Technical Articles ID: KB91111
Last Modified: 2024-04-03 10:50:00 Etc/GMT

Environment

Endpoint Security (ENS) 10.x
Microsoft Office
Fasoo Enterprise Digital Rights Management (DRM)

Problem

When ENS is installed and enabled, and the third-party software Fasoo is present on a system, Microsoft Office applications don't open. Examples of Microsoft Office applications include Word and PowerPoint.

Cause

The Fasoo software injects third-party DLLs into ENS processes, and ENS doesn't support the Fasoo hooking method. The following ENS modules can be affected by the issue:

Exploit Prevention
AMSI scanning within Threat Prevention
AMSI scanning within Adaptive Threat Protection

Solution

To allow the Office applications to open without any issues, use one of the following options:

Disable the Fasoo Enterprise DRM Add-In.
Create an ENS Exploit Prevention exclusion, for example:
- Type: Illegal API Use - Buffer Overflow
- Process Name: office16 apps
- Process File name or path: c:\Program Files\Microsoft Office\Office16\*.exe
- Process Signer: Click Enable digital signature check
- Process Signed by: C=US, S=Washington, L=Redmond, O=Microsoft Corporation, OU=MOPR, CN=Microsoft Corporation
Add AMSI scanning exclusions for the applications that are being hooked by Fasoo and ENS

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Microsoft Office applications don't open when Fasoo is present along with Trellix ENS

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Microsoft Office applications don't open when Fasoo is present along with Trellix ENS

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title